Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

full dump has modules shifted - why?

1 view
Skip to first unread message

Arno

unread,
Sep 23, 2009, 3:23:59 PM9/23/09
to
Hello,

I have a full memory 32-bit process dump where the module base
addresses returned by lm do not match the actual modules. I found the
actual modules by searching for byte sequences, user32.dll for example
is shifted by minus 0xEBE000 bytes w.r.t. the address given in lm.
user32.dll is not relocated, at least the address given by lm matches
the load address of user32.dll. !dh user32 returns "No file header". !
dh 7D4A2000 returns a header that looks o.k., but it has 0x7E360000 as
"image base". This all makes little sense to me. Did windbg or
MiniDumpWriteDump forgot a piece of memory, so everything got shifted?

Thanks for any help,

Arno

Arno

unread,
Nov 5, 2009, 6:57:08 AM11/5/09
to
To answer my own question, a virus seemed to be involved.
0 new messages